GDPRData protection
Applies to youIf you process personal data: almost every business.
With AIA legal basis for using the data, informing people, an impact assessment if the risk is high and the right to have a person review automated decisions.
Home · AI Act guide
Free guide · Legal Tech
Guide to the EU AI Act for businesses
What it is, who it affects, what the deadlines are, how much non-compliance can cost and what you should do now. Explained without jargon and with references to the official text.
- 10-minute read
- Up-to-date timeline
- Free
1 · What it is
The first comprehensive law on artificial intelligence
Regulation (EU) 2024/1689, known as the European AI Regulation or AI Act, governs how artificial intelligence systems are developed and used in the European Union. It applies directly in every country, with no need for a national law to transpose it.
Its approach is based on risk: the greater the risk an AI system poses to people’s health, safety or rights, the more obligations it carries. Most everyday uses have few or none, but some are prohibited and others require strict controls.
2 · Who it affects
Not just those who develop AI: those who use it too
It affects any organisation that develops, markets or uses AI systems in the EU, even if it is based outside it. If your business uses ChatGPT, a chatbot on its website or a tool that makes decisions with AI, the Act affects you.
ProvidersThey develop an AI system or market it under their own name. They carry the most obligations.
DeployersThey use an AI system in their professional activity. This is the role of most businesses.
Importers and distributorsThey place third-party AI systems on the EU market or make them available there.
General-purpose modelsThose who develop large models, such as the ones behind ChatGPT, have their own obligations.
3 · Risk levels
Four levels, four types of obligation
Prohibited
Unacceptable
Uses considered a threat to people’s rights.
- Social scoring of people
- Manipulation that exploits vulnerabilities
- Emotion recognition at work or at school
- Mass scraping of facial images from the internet
Strict obligations
High risk
Systems that can affect important decisions about people.
- Recruitment and employee assessment
- Granting credit or insurance
- Access and assessment in education
- Critical infrastructure and essential services
Transparency
Limited risk
Systems that interact with people or generate content.
- Chatbots: users must be told they are talking to an AI
- Content generated or manipulated with AI (deepfakes)
- AI-generated texts that inform the public
No specific obligations
Minimal risk
The vast majority of AI uses in business.
- Spam filters
- Product recommendations
- Writing or summarising assistants
- Automation of internal tasks
4 · Timeline
A phased timeline
- Entry into force
The Act is published and the countdown begins.
- Prohibitions and AI literacy
Certain practices are banned and staff using AI must have sufficient training.
- General-purpose models
Obligations for large models, penalty regime and supervisory authorities.
- General date
Most of the Act applies: transparency and, in principle, Annex III high-risk systems.
- Regulated products
High-risk AI built into products such as medical devices, toys or machinery.
Deadlines under review. In November 2025 the European Commission proposed postponing some obligations for high-risk systems as part of its digital simplification package. Before planning, check the current status of the deadlines or ask us.
5 · Penalties
Up to 7% of worldwide turnover
35 M€or 7% of worldwide turnover
For using prohibited AI practices.
15 M€or 3% of worldwide turnover
For breaching other obligations, such as those on high risk or transparency.
7,5 M€or 1% of worldwide turnover
For supplying incorrect or misleading information to the authorities.
The higher of the two amounts applies. For SMEs and start-ups, however, the lower one applies, but fines can still be very significant.
6 · Other rules
One piece of work, several rules complied with
The AI Act sits alongside other European laws that probably already affect you. The good news: they share much of what they require.
NIS2Cybersecurity
Applies to youIf you are a medium-sized or large company in an essential or important sector: energy, health, transport, digital, industry…
With AIYour AI systems become part of your cybersecurity risk management, just like the rest of your technology.
DORAFinancial sector
Applies to youIf you are a bank, insurer, payment or investment firm, or provide them with technology services.
With AIAI is part of technology risk: it must be controlled, tested and its providers monitored.
Do the work once, cover several rules
These controls serve both the AI Act and other regulations at the same time. Tackling them together saves time and paperwork.
| What you do once… | AI Act | GDPR | NIS2 | DORA |
|---|---|---|---|---|
| Inventory of systems and data | ||||
| Risk assessment | ||||
| Supplier oversight | ||||
| Reporting serious incidents | ||||
| Team training | – | |||
| Human oversight of decisions | – | – |
PDF guide · Free
The full guide, as a PDF
72 pages in book format (in Spanish), to read at your own pace, print or share with your team: from the legal framework to a compliance roadmap, with examples for SMEs.
- 18 chapters and 3 annexes
- References to every article
- Printable compliance checklist
Guide written on 18 October 2026 based on Regulation (EU) 2024/1689 (OJ L, 12 July 2024). The rules and their deadlines may change after that date. This guide provides general information and does not constitute legal advice. To analyse your company’s specific case, request a free audit.
Common questions
Frequently asked questions
Does it affect me if I only use ChatGPT or other AI tools?
Yes, at least in part. As a deployer you must ensure your staff have AI training and, depending on the use, comply with transparency obligations.
From when do I have to comply?
The prohibitions and AI literacy have applied since 2 February 2025. Most obligations apply from 2 August 2026, although some high-risk deadlines are under review.
Do SMEs have fewer obligations?
Obligations depend on the system’s risk, not on company size. There are support measures, though, and if a penalty is imposed, the lower of the amounts provided for applies.
Does your business comply with the AI Act?
We tell you what applies to you, what you are missing and where to start. Free audit, reply in under 24 hours.
Get your free audit →